Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-06-2024 05:33

General

  • Target

    f3c908fcfa2458ee26330d428452d8de4bf8a155a8104bc2ead6d31cf670113b.exe

  • Size

    1.4MB

  • MD5

    5f1b08b90203ae6096cefb292497dbd8

  • SHA1

    2af27bfac0881d689819a1eeae9fc59faa5b5e86

  • SHA256

    f3c908fcfa2458ee26330d428452d8de4bf8a155a8104bc2ead6d31cf670113b

  • SHA512

    43d8269d3d82eb49316bcc5aaa4254ebe7e7a82852a9103f68cb34de953e9dea7b438ec226272682e45699906f4f53ba46f28c2f56008cf429c911cd3c57f022

  • SSDEEP

    12288:1/JHKuRszP8SDIPT8FgswcC38AER32BF7gxX1i5FtdA8wfrk4s/CFoee7BwoVn5d:1/e78r8FfC3K32nUnCdAaKu++nO

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f3c908fcfa2458ee26330d428452d8de4bf8a155a8104bc2ead6d31cf670113b.exe
    "C:\Users\Admin\AppData\Local\Temp\f3c908fcfa2458ee26330d428452d8de4bf8a155a8104bc2ead6d31cf670113b.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2876
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43DF.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2912
      • C:\Users\Admin\AppData\Local\Temp\f3c908fcfa2458ee26330d428452d8de4bf8a155a8104bc2ead6d31cf670113b.exe
        "C:\Users\Admin\AppData\Local\Temp\f3c908fcfa2458ee26330d428452d8de4bf8a155a8104bc2ead6d31cf670113b.exe"
        3⤵
        • Executes dropped EXE
        PID:2548
    • C:\Windows\Logo1_.exe
      C:\Windows\Logo1_.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4804
      • C:\Windows\SysWOW64\net.exe
        net stop "Kingsoft AntiVirus Service"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3464
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
          4⤵
            PID:4492

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\7-Zip\7zG.exe

      Filesize

      750KB

      MD5

      74a562bc868f4b6042abe60236d381e0

      SHA1

      1f30ac25a134b2c211ee3280123feb89cc522c87

      SHA256

      ecdace247ec475259f3a7bdddc7390dba1a4c643b1b8456fba7721b29cbc3fc9

      SHA512

      a1ec48ec10da7b63598d8164739fc99ab49c5b604c7aeb87cdb0a3c0a4116ce9e0da498ab0cf8f0a3db3dc34b368cf4f37ed5c6a724bf52e307b2f521d426647

    • C:\Users\Admin\AppData\Local\Temp\$$a43DF.bat

      Filesize

      722B

      MD5

      a44861abf220cdbc40602d8447bf4bb2

      SHA1

      5f61cfd6c5c1fdd02ef8775a72175a1e057c5db7

      SHA256

      5f7dc4f885e08b0a753c5cd0ff9e748f8d75e071613fa887706f743b37fa1fb0

      SHA512

      156f9c3d1318a4feb4f9c3a870a14dd78de2bbf5edcdb2e264c825988bdf9d2f92bc582ce68acb120a881908fd81b3bf313ff4327d94ff8c79bac79373e30029

    • C:\Users\Admin\AppData\Local\Temp\f3c908fcfa2458ee26330d428452d8de4bf8a155a8104bc2ead6d31cf670113b.exe.exe

      Filesize

      1.3MB

      MD5

      8c8f836d800e90714a97bc03f6115bc6

      SHA1

      fc67a3917c813d5ac8d7c2b051071111ed35c398

      SHA256

      7157422d57f76d8fb5824c21c8a336748ff99bd8e84f683396d014d290a7c6c4

      SHA512

      cc25ce20b0cc11401a5da1d6f22b4f3295ecdeaded8a564eb14117134f07e2e31e545bc036576360985eee39c44beb2a5e37376bf34b167718644208c86cff5b

    • C:\Windows\Logo1_.exe

      Filesize

      66KB

      MD5

      bac152d659a8e5c8b297ee885a362ab7

      SHA1

      e35922075011a55e96a69695645985ed2e4d7336

      SHA256

      db778391e2816d919f43276cff95d64e544e28e8f4262a8722e9e904038af413

      SHA512

      ec5a747cd6602130886b0c04638eac550a8dc287368ff3fba6b526bd83f4f678b8ebc3d6482a0282aba720af556df91ae986cccef36c5b77465c4f0003c9a150

    • memory/2876-7-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/4804-12-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/4804-13-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/4804-15-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/4804-17-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/4804-141-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/4804-207-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/4804-220-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB